OpenAI's ad collector at bzr.openai.com sets a cookie called __obi scoped to .openai.com, tied to your ChatGPT account. This identifier is then sent to OpenAI from ordinary websites you visit. Any company buying ads on ChatGPT installs OpenAI tracking code on its site, similar to Meta and Google trackers. Loading that code sends __obi to OpenAI along with data about the page you browse — products searched, articles read, and purchase behaviors — connecting your activity to your ChatGPT account.

The mechanism was reproduced and verified across 936 distinct advertiser pixels on 1,029 hostnames. Step 1: ChatGPT generates a 16-byte identifier and calls POST /backend-api/bazaar/obi/sync-token, receiving an RS256 JWT binding the account (sub) and obi identifier, expiring in 60 seconds. Step 2: The client POSTs the token cross-site to bzr.openai.com/v1/obi/sync, setting __obi cookie with Max-Age=31536000 (one year), SameSite=none; Secure. Step 3: Advertiser sites send __obi back via three request classes — SDK script loads, conversion events, and bare events — all carrying the cookie.

The SDK also scrapes identity from form fields (fm), page text (ht), and tag-manager bus (js). Scraped identity events (685) outnumbered advertiser-supplied (255). Email and phone are SHA-256 hashed; country, region, city, and postal code sent in clear. Postal code was the most-harvested field (100 events across 28 sites). URLs reduced to origin plus path; no query strings observed in 23,929 events.